Holdover
Download

Privacy Policy

Last updated: 9 September 2026

Holdover is a Mac app that keeps a history of what you copy. A clipboard manager sees everything that passes through your clipboard, including the things you would never type into someone else's software, so this policy matters more than most. It is short because the app collects nothing.

What Holdover stores

Your clipboard history, meaning the text of a clip, its kind, the app it came from and its timestamps, is written to a single SQLite file on your own Mac, alongside a folder of images and rich text named by content hash:

~/Library/Application Support/Holdover/clips.sqlite
~/Library/Application Support/Holdover/blobs/

The folder is created with 0700 and the files inside it with 0600, so other user accounts on the Mac cannot read them. Beyond that the data is not encrypted at rest: it sits in your user directory and inherits FileVault. Treat it the way you would treat ~/Documents.

Those files never leave your computer. There is no account to create, no server to sync with, and no copy of anything you copied anywhere but your own disk.

What Holdover sends

Out of the box, nothing at all. No analytics, no telemetry, no crash reporting and no advertising identifier, ever. Info.plist declares no network usage, and the only frameworks linked are AppKit, SwiftUI, SQLite, ImageIO, CryptoKit, ServiceManagement and Carbon.

Two settings can open a connection, and both are off until you turn them on:

  • Settings › General › Check for a newer version once a day. Described in full below.
  • Settings › History › Clips copied on your iPhone or iPad. Fetching one of those goes over the network the way Universal Clipboard always does, and that is macOS doing it rather than Holdover.

You do not have to take any of this on trust. With the app running:

nettop -p $(pgrep -f Holdover.app/Contents/MacOS/Holdover)

With both settings off, the process holds no sockets at all.

The update check

Holdover is not on the App Store and cannot be signed with a Developer ID yet, so nothing would otherwise tell you a newer version exists. Turn the check on and, once a day at most, the app asks one address for a version number:

{ "version": "1.1.0", "url": "https://holdover.app/Holdover-1.1.0.dmg" }

It is a plain request with no query string, no identifier and no body. It carries what any web request unavoidably carries, such as your IP address, and nothing else. Nothing about your clipboard, your machine or how you use the app is sent, because none of it is in the request to begin with.

Nothing is ever installed for you. If there is a newer version the menu bar says so, and taking the offer opens the download page in your browser. That is deliberate: replacing the app changes its code signature, macOS identifies apps to itself by signature, and so every update revokes Accessibility. An updater that installed quietly in the background would leave Holdover running with pasting broken and no visible reason.

Your iPhone's clipboard

Universal Clipboard makes a clip copied on your phone available on your Mac, but the contents stay on the phone until something reads them. A clipboard manager that reads the pasteboard the moment it changes therefore drags every phone clip across automatically, which is what puts the system's "Pasting from …" window on screen without you asking for anything.

Holdover does not do that. It reads the pasteboard's list of types, which is local, notices the Continuity marker, and stops. Nothing is fetched and nothing is stored, and ⌘V still pulls the clip on demand exactly as it would with no clipboard manager installed.

What is never stored

  • Password managers. Twenty-two credential tools are excluded out of the box, including 1Password, Bitwarden, KeePassXC, Keychain Access, the macOS Passwords app, Dashlane, Keeper, LastPass, Enpass, Strongbox, NordPass and Proton Pass. You can add any other app in Settings › Privacy.
  • Anything an app marks as concealed. Holdover honours the nspasteboard.org conventions, so an app asking every clipboard manager to ignore a copy is obeyed by default.
  • Holdover's own writes. Pasting puts the clip back on the pasteboard with a private marker, so it is never recorded a second time.

Anything that looks like a credential is detected as it is captured and, by default, stored with its preview replaced by dots. Set Settings › Privacy › "When detected" to "Never save" and those clips are dropped instead of hidden.

Why Holdover asks for Accessibility

For one thing: pressing ⌘V in the window you were working in, so a clip lands where you wanted it. Decline the permission and the app still works, it just puts the clip on your clipboard and leaves the paste to you.

There is no Full Disk Access, no Screen Recording, no Automation and no Input Monitoring. The global shortcut uses Carbon hot keys, which need no permission at all, and the notch hover is a tracking area rather than anything watching your input.

Text inside images

Screenshots are read on device with Vision so they can be searched by what they say. Nothing is uploaded and no model is downloaded. Recognition runs in a short lived child process that exits as soon as it has answered. Turn it off in Settings › History.

Staying in control

  • Pause capture from the menu bar stops recording immediately.
  • Exclude apps in Settings › Privacy so nothing copied in them is saved.
  • Retention expires history by count, by age and by attachment size.
  • Delete Everything removes every clip, pinned ones included, and sweeps the blob store.
  • Deleting the app and the folder above removes every trace of it.

Children

Holdover is a general-purpose utility and is not directed at children.

Changes

If this policy changes, the date at the top changes with it.

Contact

Questions: hello@holdover.app